The Current Framework and the Purpose of the Law
Cybersecurity in Georgia is governed today by the law on information security — a separate cybersecurity law has not yet been adopted, and this law is the operating regime. Its purpose is to promote effective information security protection, establish the rights and duties of the public and private sectors, and define the mechanisms of state control. The framework covers critical information systems and their subjects and is the legal foundation of critical infrastructure protection obligations.
Key Concepts and Categories of Subjects
Article 2 defines the key concepts: information security protects the access, integrity, authentication, confidentiality and continuous operation of information and systems; a cyberattack uses an electronic device or network to violate the integrity of systems or obtain information unlawfully; a computer incident violates the confidentiality, integrity or availability of information. A critical information system is one whose continuous functioning is important for defense, economic security, state government or society. Subjects fall into three categories: the first — state and municipal bodies and state enterprises created with more than 50% state participation; the second — electronic communication companies; the third — private legal entities. The list is approved by the government on the proposal of the Ministry of Justice, agreed with the defense and interior ministries and the State Security Service.
The perimeter of the most stringent duties is not fixed inside the law itself: the categories of critical information system subjects are determined by decree of the Government of Georgia — the first category covers state and municipal bodies and state enterprises, the second electronic communications companies, and the third other private-law legal entities. Whether an organisation falls inside the regime is therefore checked against the current decree, not against the statute alone.